Privacy · Yardroll

Accounts

What is stored: your username (never shown on the site), the kind of account, a one-way hash of your password and of your recovery code (neither can be read back), when the account was made and last signed in, and a salted one-way hash of the network address it was made from (used only to look into abuse; cleared 90 days after the account was made).
Sign-in: a cookie named __Host-yr_acct holds a random token for 30 days; the site stores only a hash of it. Signing out ends it.
Closing the account withdraws your ratings, takes your listings off the roll and deletes your shortlist; the closed record is purged after 90 days.

Listings, ratings and answers

What you send is shown publicly once a person has published it. A rating never shows who wrote it, only "a signed-in client"; the desk can see which account sent it.
Text of anything rejected, removed, withdrawn or closed is cleared 90 days after that decision. When a business takes its listing off the roll, its ratings and the answers under them are closed with it.
Listings, ratings, reports and disputes keep a salted one-way hash of the network address they were sent from, only to look into abuse; it is cleared 90 days after they were sent.
Reports ask for no contact details. A dispute asks for an email address so the desk can reply by hand; it is never shown and is cleared 90 days after the decision.

Other cookies and counters

__Host-yr_csrf protects forms (it holds a random token). No advertising or tracking cookies are set by Yardroll.
To limit abuse, the site counts form submissions and failed sign-ins per day against a salted one-way hash of the network address (and failed sign-ins also against a salted hash of the username tried); those counters are deleted after two days.
Like any website, the web server keeps a standard access log (network address, time, page asked for, browser) for security; it is deleted on a rolling schedule.

Advertising

Some public pages of Yardroll (not forms, accounts, the shortlist or this page) show one banner ad from AdEngine (adengine.us), the small ad network run by WeldonPC, the company behind this site. For now the ads are for WeldonPC's own services. No landscaping business advertises on Yardroll.

To show an ad, your browser loads a script from adengine.us, asks it for one banner, loads the banner image, and reports once that the page was viewed and once that the banner was shown. Like any website, adengine.us receives your IP address, your browser type and the address of this site with those requests.

No cookies, no profile. AdEngine sets no cookies, gives you no ID and does not track you from site to site.
How your IP address is used. adengine.us looks up the approximate city for your IP address in a location database kept on its own server (nothing is sent to anyone else), so that ads meant for one area are shown only there. It also uses the address to count each ad view or click only once and to leave out robots and WeldonPC's own office traffic. The address is not stored with the counts; the temporary entries made from it expire within six hours and are cleared from the server within two days.
What is kept. Daily totals only: page views for this site, and views and clicks for each ad. The adengine.us web server also keeps a standard access log (IP address, time, address requested, referring site, browser) for security; it is deleted on a rolling schedule.
Clicking an ad passes through adengine.us, which counts the click, and then opens the advertiser's site, which has its own privacy policy.
Nothing about you is sold or shared.

Outside services

The only outside service the pages load is the adengine.us ad described above. Fonts and everything else come from this site. Yardroll uses no analytics service; the ad tag counts one page view per page as a daily total. When payments start, Plus checkout will hand you to PayPal, which has its own privacy policy.

Who runs it